nworm | 32060ba18c4ed29f6a441b6193a2e6376bb43c752709558f046e9365b7275559

General

Target

ServerFAH.ps1
Size

134KB
MD5

327fee2e572cf6b3b337fded32308189
SHA1

8046a0f02d0673d3833b40bc5ac885b0a8891079
SHA256

32060ba18c4ed29f6a441b6193a2e6376bb43c752709558f046e9365b7275559
SHA512

be2e0938b929177621c7b9d324c2245ecef46e9b9b1b93204e1663edc2e9ee12f05e3e350362f7a6863d906bff2eb3e3b804a66d05a5c4cb4e87a7175b12bea8

Score

10^/10

nworm downloader worm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

nyanmoj.duckdns.org:5057

moneyhope81.duckdns.org:5057

Mutex

cb2d3cba

Signatures

NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
worm downloader nworm
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3284 836 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 4048 set thread context of 1988 4048 powershell.exe aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1796 powershell.exe
1796 powershell.exe
3956 powershell.exe
3956 powershell.exe
4048 powershell.exe
4048 powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3284	836	cmd.exe

description	pid	process	target process
PID 4048 set thread context of 1988	4048	powershell.exe	aspnet_compiler.exe

pid	process
1796	powershell.exe
1796	powershell.exe
3956	powershell.exe
3956	powershell.exe
4048	powershell.exe
4048	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	4048	powershell.exe
Token: SeIncreaseQuotaPrivilege	3956	powershell.exe
Token: SeSecurityPrivilege	3956	powershell.exe
Token: SeTakeOwnershipPrivilege	3956	powershell.exe
Token: SeLoadDriverPrivilege	3956	powershell.exe
Token: SeSystemProfilePrivilege	3956	powershell.exe
Token: SeSystemtimePrivilege	3956	powershell.exe
Token: SeProfSingleProcessPrivilege	3956	powershell.exe
Token: SeIncBasePriorityPrivilege	3956	powershell.exe
Token: SeCreatePagefilePrivilege	3956	powershell.exe
Token: SeBackupPrivilege	3956	powershell.exe
Token: SeRestorePrivilege	3956	powershell.exe
Token: SeShutdownPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeSystemEnvironmentPrivilege	3956	powershell.exe
Token: SeRemoteShutdownPrivilege	3956	powershell.exe
Token: SeUndockPrivilege	3956	powershell.exe
Token: SeManageVolumePrivilege	3956	powershell.exe
Token: 33	3956	powershell.exe
Token: 34	3956	powershell.exe
Token: 35	3956	powershell.exe
Token: 36	3956	powershell.exe
Token: SeIncreaseQuotaPrivilege	3956	powershell.exe
Token: SeSecurityPrivilege	3956	powershell.exe
Token: SeTakeOwnershipPrivilege	3956	powershell.exe
Token: SeLoadDriverPrivilege	3956	powershell.exe
Token: SeSystemProfilePrivilege	3956	powershell.exe
Token: SeSystemtimePrivilege	3956	powershell.exe
Token: SeProfSingleProcessPrivilege	3956	powershell.exe
Token: SeIncBasePriorityPrivilege	3956	powershell.exe
Token: SeCreatePagefilePrivilege	3956	powershell.exe
Token: SeBackupPrivilege	3956	powershell.exe
Token: SeRestorePrivilege	3956	powershell.exe
Token: SeShutdownPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeSystemEnvironmentPrivilege	3956	powershell.exe
Token: SeRemoteShutdownPrivilege	3956	powershell.exe
Token: SeUndockPrivilege	3956	powershell.exe
Token: SeManageVolumePrivilege	3956	powershell.exe
Token: 33	3956	powershell.exe
Token: 34	3956	powershell.exe
Token: 35	3956	powershell.exe
Token: 36	3956	powershell.exe
Token: SeIncreaseQuotaPrivilege	3956	powershell.exe
Token: SeSecurityPrivilege	3956	powershell.exe
Token: SeTakeOwnershipPrivilege	3956	powershell.exe
Token: SeLoadDriverPrivilege	3956	powershell.exe
Token: SeSystemProfilePrivilege	3956	powershell.exe
Token: SeSystemtimePrivilege	3956	powershell.exe
Token: SeProfSingleProcessPrivilege	3956	powershell.exe
Token: SeIncBasePriorityPrivilege	3956	powershell.exe
Token: SeCreatePagefilePrivilege	3956	powershell.exe
Token: SeBackupPrivilege	3956	powershell.exe
Token: SeRestorePrivilege	3956	powershell.exe
Token: SeShutdownPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeSystemEnvironmentPrivilege	3956	powershell.exe
Token: SeRemoteShutdownPrivilege	3956	powershell.exe
Token: SeUndockPrivilege	3956	powershell.exe
Token: SeManageVolumePrivilege	3956	powershell.exe
Token: 33	3956	powershell.exe
Token: 34	3956	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

powershell.exepowershell.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 1796 wrote to memory of 3956	1796	powershell.exe	powershell.exe
PID 1796 wrote to memory of 3956	1796	powershell.exe	powershell.exe
PID 3956 wrote to memory of 3852	3956	powershell.exe	WScript.exe
PID 3956 wrote to memory of 3852	3956	powershell.exe	WScript.exe
PID 3284 wrote to memory of 2656	3284	cmd.exe	cmd.exe
PID 3284 wrote to memory of 2656	3284	cmd.exe	cmd.exe
PID 2656 wrote to memory of 4048	2656	cmd.exe	powershell.exe
PID 2656 wrote to memory of 4048	2656	cmd.exe	powershell.exe
PID 4048 wrote to memory of 1988	4048	powershell.exe	aspnet_compiler.exe
PID 4048 wrote to memory of 1988	4048	powershell.exe	aspnet_compiler.exe
PID 4048 wrote to memory of 1988	4048	powershell.exe	aspnet_compiler.exe
PID 4048 wrote to memory of 1988	4048	powershell.exe	aspnet_compiler.exe
PID 4048 wrote to memory of 1988	4048	powershell.exe	aspnet_compiler.exe
PID 4048 wrote to memory of 1988	4048	powershell.exe	aspnet_compiler.exe
PID 4048 wrote to memory of 1988	4048	powershell.exe	aspnet_compiler.exe
PID 4048 wrote to memory of 1988	4048	powershell.exe	aspnet_compiler.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ServerFAH.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoE -Nop -NonI -WIndoWSTYLe HiDdeN -ExecutionPolicy Bypass -file C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.ps1
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.vbs"
3⤵
PID:3852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.bat
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3284

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noe -nop -nonI -WIndoWSTYLe Hidden -executionPolicy Bypass -file C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\WZQNBDSLVGAWPUXJRUVDYE.ps1
2⤵
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noe -nop -nonI -WIndoWSTYLe Hidden -executionPolicy Bypass -file C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\WZQNBDSLVGAWPUXJRUVDYE.ps1
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
4⤵
PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.bat
MD5
1ca2d431085aeaf74a34fa288ee241ce

SHA1
c2eee8833239a4f314c788974cd918458213d2cd

SHA256
1b14dced54fee58bc9101ae0a0d99be3d8e5ec293937f25177acc12d1775d764

SHA512
74cb10e76aa479a3076b9e35841cb75aea03bdd7b7a521961be10a403441d6f22c6641f7f92d00a59fc77c12829f4fe216e7fcb1e6aa6d2e2ff26376f55515ec

Download Submit
C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.ps1
MD5
abbd84fe458a51e5e93dc62ba2a33313

SHA1
df97c89da1a0eaac1485afb1210ffc034e458e65

SHA256
197d956d33beac34ac8a9b79c460508d28e9069977a27712150695ad2fa8eb22

SHA512
6acb1ba6d93aea7e6857f95a3ca7399050b384283f1c9fbf2bdd52e49d09e1aba8a44106621a07b5f01be55e3bf90e0d405a8485bfd396902e7dacba1da37af6

Download Submit
C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\LZAVOBYIRFWZQZVCTGHPQB.vbs
MD5
8fd7979dccc0170bfb3a586d28d572c8

SHA1
85873a74e36ec1f8e5c92a28492be96b7fc1afee

SHA256
0bcec1d4172f5edf9956023c08752b93be00eee1d1dd7ee027e70bab737bfedf

SHA512
c0e093348d0c15bdeed81bcec7ef66a080834edba3ab25d6405e68727d944ec0425b755d9f21a7d550b3ff17edb78e7ea9a2843df4f6c8d9d67a6a26ca713ec2

Download Submit
C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB\WZQNBDSLVGAWPUXJRUVDYE.ps1
MD5
3fbbaee606b9fa5ed730aab0c6123ce0

SHA1
a38435566b572cd77b2b5521cf50d830518ba9cf

SHA256
2d89ba4be26780c15328677895a43b6b31791a25105892d562cacf7fc902299d

SHA512
9cb3c6aa7021c09ec5c54520066fea23195e87c5cac41b2eba7bd8a0f31edc23414ebe4bbe3524ebcc2e100c3aec179987e58e11587205d4242302fa92b33f2f

Download Submit
memory/1796-132-0x00007FFA2C4F3000-0x00007FFA2C4F5000-memory.dmp

Filesize
8KB

Download
memory/1796-140-0x00000153A5086000-0x00000153A5088000-memory.dmp

Filesize
8KB

Download
memory/1796-139-0x00000153A5083000-0x00000153A5085000-memory.dmp

Filesize
8KB

Download
memory/1796-138-0x00000153A5080000-0x00000153A5082000-memory.dmp

Filesize
8KB

Download
memory/1796-135-0x00000153A5050000-0x00000153A5072000-memory.dmp

Filesize
136KB

Download
memory/1988-173-0x0000000005460000-0x00000000054C6000-memory.dmp

Filesize
408KB

Download
memory/1988-172-0x0000000005A10000-0x0000000005FB4000-memory.dmp

Filesize
5.6MB

Download
memory/1988-171-0x00000000053C0000-0x000000000545C000-memory.dmp

Filesize
624KB

Download
memory/1988-170-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/1988-168-0x00000000749BE000-0x00000000749BF000-memory.dmp

Filesize
4KB

Download
memory/1988-166-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3956-148-0x00007FFA2C4F3000-0x00007FFA2C4F5000-memory.dmp

Filesize
8KB

Download
memory/3956-169-0x0000022D58B18000-0x0000022D58B1A000-memory.dmp

Filesize
8KB

Download
memory/3956-151-0x0000022D58B16000-0x0000022D58B18000-memory.dmp

Filesize
8KB

Download
memory/3956-150-0x0000022D58B13000-0x0000022D58B15000-memory.dmp

Filesize
8KB

Download
memory/3956-149-0x0000022D58B10000-0x0000022D58B12000-memory.dmp

Filesize
8KB

Download
memory/4048-163-0x00000285F28A6000-0x00000285F28A8000-memory.dmp

Filesize
8KB

Download
memory/4048-165-0x00000285F2BD0000-0x00000285F2BEA000-memory.dmp

Filesize
104KB

Download
memory/4048-162-0x00000285F28A3000-0x00000285F28A5000-memory.dmp

Filesize
8KB

Download
memory/4048-160-0x00007FFA2C4F3000-0x00007FFA2C4F5000-memory.dmp

Filesize
8KB

Download
memory/4048-161-0x00000285F28A0000-0x00000285F28A2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing